geek-boy / sumologic-cli

This application allows you to run queries against the Sumologic Search Job API (https://help.sumologic.com/APIs/Search-Job-API/About-the-Search-Job-API). It will download resuts locally to your home directory.

Sumologic CLI

Tool for running Sumologic queries from the command line. This application allows you to run queries against the Sumologic Search Job API (https://help.sumologic.com/APIs/Search-Job-API/About-the-Search-Job-API). It will download resuts locally to your home directory.

Installation

After cloning the repository then install using composer from the code directory:

composer install

Once this is done you should be good to use the application by using:

./sumologic-cli

The main command, query:run, makes a request to the Sumologic Job Search API to run a Query and save results locally. The search query for the Sumologic Job Search API can be provided either from a file, if it is more complex, or by using the --search-query option for simpler search queries.

Examples ways to run the query:run command:

• sumologic-cli query:run /home/user/query_file 2021-06-05T11:09:00 2021-06-05T12:09:00
• sumologic-cli query:run --end="-7days" /home/user/query_file.txt 2021-06-05T11:09:00
• sumologic-cli query:run --format=csv /home/user/query_file 2021-06-05T11:09:00 2021-06-05T12:09:00
• sumologic-cli query:run --search-query="namespace=agoorah.apache-access" 2021-06-05T11:09:00 2021-06-05T12:09:00
• sumologic-cli query:run --search-query="namespace=agoorah.apache-access" --start="-2hours" --end="-1hour"
• sumologic-cli query:run --search-query="namespace=agoorah.apache-access" --start="-2hours" --end="-1hour" --format=tab
• sumologic-cli query:run --search-query="namespace=agoorah.apache-access" --start="-2hours"
• sumologic-cli query:run --search-query="namespace=agoorah.apache-access" --fields-only --start="-2hours" --end="-1hour"
• sumologic-cli query:run --search-query="namespace=agoorah.apache-access" --fields-only --start="-2hours" --end="-1hour" --format=tab

See https://www.php.net/manual/en/class.datetimeinterface.php for ISO Date format.

See https://www.php.net/manual/en/datetime.formats.relative.php for valid relative time formats.

sumologic-cli's Issues

Update documentation on how aggregates are handled

Add to documentation about how aggregates are handled as per https://help.sumologic.com/APIs/Search-Job-API/About-the-Search-Job-API#more-about-results:

If the query contains an aggregation, for example, count by _sourceCategory, then the messages are returned along with records resulting from the aggregation (similar to what a SQL database would return).

Refactor ApiController using dependency injection

Add option to only grab `_raw` field

Add in an option that returns only the _raw field in query results

Feature request: Create default directory where all logs are stored for easy navigation

Can we create default directory where all logs are stored for easy navigation?

Fix up $input reference for PHP 8

When running the code for PHP 8 the following error occurs when attempting to download messages:

PHP Fatal error:  Uncaught TypeError: Symfony\Component\Console\Helper\QuestionHelper::ask(): Argument #1 ($input) must be of type Symfony\Component\Console\Input\InputInterface, null given, called in /Users/mark.corben/Projects/sumologic-cli/src/Command/QueryRunCommand.php on line 648 and defined in /Users/mark.corben/Projects/sumologic-cli/vendor/symfony/console/Helper/QuestionHelper.php:48
Stack trace:
#0 /Users/mark.corben/Projects/sumologic-cli/src/Command/QueryRunCommand.php(648): Symfony\Component\Console\Helper\QuestionHelper->ask(NULL, Object(Symfony\Component\Console\Output\ConsoleOutput), Object(Symfony\Component\Console\Question\ConfirmationQuestion))
#1 /Users/mark.corben/Projects/sumologic-cli/src/Command/QueryRunCommand.php(478): App\Command\QueryRunCommand->saveQueryResults(Object(Symfony\Component\Console\Output\ConsoleOutput), '3A888A79A7F3A39...', 31, 0, 10000, 'json', 'messages')
#2 /Users/mark.corben/Projects/sumologic-cli/vendor/symfony/console/Command/Command.php(256): App\Command\QueryRunCommand->execute(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#3 /Users/mark.corben/Projects/sumologic-cli/vendor/symfony/console/Application.php(971): Symfony\Component\Console\Command\Command->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))

Example command that produces error:

./sumologic-cli query:run --search-query="amplife.php-errors \"2021-09-09T23:24:35\"" --start="-6days" --end="now"

Document methods inside the Classes

Create comments in the classes for easier understanding of the application

Fix up suggested command for "--fields-only".

Fix up suggested command for "--fields-only".
Need to take out suggested fields - "isodate", "namespace", "msg".